<?php

namespace rnadvanceemailingwc\Managers;

use rnadvanceemailingwc\core\Loader;

/**
 * Handles security validations during email template save and preview operations.
 * Prevents non-SuperAdmin users from injecting or executing dynamic PHP code
 * through the Formula Builder.
 */
class SaveManager
{
    /**
     * Validates that a non-SuperAdmin user is not injecting or modifying PHP code
     * in custom fields.
     *
     * @param int $emailId The email template ID (0 for new templates)
     * @param array|object $customFields The custom fields being saved (from EmailBuilderOptionsDTO)
     * @param Loader $loader The plugin loader instance
     * @return string|null Error message if validation fails, null if OK
     */
    public static function ValidatePHPCodeSecurity($emailId, $customFields, $loader)
    {
        if(is_super_admin())
            return null;

        $newPHPCodes = self::ExtractPHPCodes($customFields);

        if($emailId == 0 || $emailId == null)
        {
            // New template: no PHP code allowed at all
            if(count($newPHPCodes) > 0)
            {
                return __('Only super admins can create templates with PHP code in custom fields', 'advanced-emailing-for-woocommerce');
            }
        }
        else
        {
            // Update: compare against existing template
            global $wpdb;
            $existingRow = $wpdb->get_row($wpdb->prepare(
                'SELECT custom_fields FROM ' . $loader->EMAIL_TABLE . ' WHERE id=%d',
                $emailId
            ));

            $existingPHPCodes = [];
            if($existingRow !== null && !empty($existingRow->custom_fields))
            {
                $existingCustomFields = json_decode($existingRow->custom_fields);
                if($existingCustomFields !== null)
                    $existingPHPCodes = self::ExtractPHPCodes($existingCustomFields);
            }

            // Check if any new PHP code was added or existing code was modified
            foreach($newPHPCodes as $key => $code)
            {
                if(!isset($existingPHPCodes[$key]))
                {
                    return __('Only super admins can add PHP code to custom fields', 'advanced-emailing-for-woocommerce');
                }
                if($existingPHPCodes[$key] !== $code)
                {
                    return __('Only super admins can edit PHP code in custom fields', 'advanced-emailing-for-woocommerce');
                }
            }
        }

        return null;
    }

    /**
     * Checks whether the given custom fields contain any PHP code.
     * Used to block preview/render operations for non-SuperAdmin users
     * when the template has not yet been saved (preventing execution of
     * arbitrary unsaved PHP code).
     *
     * @param array|object $customFields The custom fields to check
     * @return bool True if PHP code is present
     */
    public static function ContainsPHPCode($customFields)
    {
        return count(self::ExtractPHPCodes($customFields)) > 0;
    }

    /**
     * Extracts all PHP code entries from custom fields.
     * Returns an associative array keyed by a unique identifier for each PHP code entry.
     *
     * @param array|object $customFields The custom fields array/list
     * @return array Keyed array of [ identifier => code ]
     */
    private static function ExtractPHPCodes($customFields)
    {
        $codes = [];
        if(empty($customFields))
            return $codes;

        if(!is_array($customFields))
            $customFields = [$customFields];

        foreach($customFields as $field)
        {
            if(is_array($field))
                $field = (object)$field;

            if(!is_object($field))
                continue;

            $codeType = isset($field->CodeType) ? $field->CodeType : '';
            if($codeType !== 'php')
                continue;

            $phpCode = isset($field->PHPCode) ? $field->PHPCode : '';
            if($phpCode === '')
                continue;

            // Use the field Id as unique identifier, fallback to Name
            $id = isset($field->Id) ? $field->Id : (isset($field->Name) ? $field->Name : 'unknown');
            $codes['customfield_' . $id] = $phpCode;
        }

        return $codes;
    }
}